CVE-2026-60738 is a vulnerability in the Oracle Installed Base product of Oracle E-Business Suite, specifically in the Create Item Instance component. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting high impact across confidentiality, integrity, and availability. The vendor advisory from Oracle’s July 2026 Critical Patch Update mentions a large number of patches but does not explicitly confirm a patch or remediation for this specific vulnerability. The advisory emphasizes the importance of applying patches promptly to mitigate known vulnerabilities.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Installed Base, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the product, potentially leading to unauthorized access, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends remaining on actively supported versions and applying security patches without delay once they become available. Until a patch is confirmed, monitor Oracle’s security advisories closely and follow any interim mitigation steps they may provide.